Subscribe to Comments EUVD-2026-104101

Requires an authenticated WordPress account with Author-level privileges or higher on a site where the Subscribe to Comments plugin prior to 2.3.3 is installed and active. The attacker exploits it by editing the plugin's notification sender-name setting and inserting newline (CR/LF) characters to append arbitrary e-mail headers (e.g. a hidden Bcc or a spoofed From). Limiting factors: the privileged role requirement means sites with no untrusted Author/Editor/Admin users are effectively not exposed; there is no unauthenticated or anonymous path, no code execution on the host, and impact is confined to outbound notification e-mail (spoofing and silent copying), not the WordPress server itself.

This is a low-severity, high-privilege issue that does not represent a broad emergency despite a publicly available exploit. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N, base 3.8) is internally consistent with the description: exploitation is network-reachable and low-complexity but gated behind an authenticated WordPress role (Author or above), with only low confidentiality and integrity impact and no availability impact. A proof-of-concept is publicly available (reported by WPScan), so this is 'publicly available exploit code exists' - NOT active exploitation. There is no CISA KEV listing and no EPSS score was supplied, so exploitation-in-the-wild cannot be asserted; absence of EPSS is a data gap, not a signal of low interest. No SSVC decision data was provided. The key tension is privilege: WPScan rated this PR:H, but WordPress Author is a mid-tier authenticated content role rather than an administrator, which arguably understates reachability (any site allowing untrusted Authors is exposed) while the real-world impact (email spoofing / hidden Bcc) remains limited. Net: a real but low-priority hardening fix, most relevant on multi-author sites with untrusted contributors, not an urgent internet-facing RCE.

A malicious or compromised Author-level user on a WordPress site running Subscribe to Comments before 2.3.3 edits the notification sender-name setting, embedding newline characters followed by an extra header such as 'Bcc: attacker@evil.test'. Because the plugin does not strip CRLF before placing the value into e-mail headers, every outgoing comment-notification is silently copied to the attacker and/or appears to come from a spoofed sender. A public proof-of-concept exists (WPScan), lowering the effort to reproduce.